Configuring NAT Gateway for Outbound Internet in AWS VPC
A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)
Quick Answer
The correct answer involves placing the NAT device in a public subnet with a route to an internet gateway and configuring the route tables of the private subnets to point all default traffic (0.0.0.0/0) to that NAT device. This works because the NAT gateway, residing in a public subnet with direct internet access via the internet gateway, translates private IP addresses to its own public IP for outbound traffic, while the private subnet route tables ensure every outbound packet is forwarded to the NAT device for centralized logging and filtering. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of VPC routing and NAT architecture for security control—a common trap is assuming a transit gateway or proxy is needed, but the key is that a NAT device in a public subnet with an internet gateway is sufficient for outbound-only internet access from private subnets. Remember the memory tip: “NAT needs a path to the outside world—public subnet and IGW—while private subnets just need a route pointing to the NAT.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.
To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose. Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy an HTTP forward proxy in the public subnet.
Why it's wrong here
A proxy is not required; a NAT device can perform network address translation.
- ✓
Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.
Why this is correct
This routes outbound traffic from private subnets to the NAT device.
- ✗
Set up a transit gateway and attach the VPC to it.
Why it's wrong here
Transit gateway is for connecting multiple VPCs, not for outbound internet traffic.
- ✗
Create a gateway endpoint for Amazon S3.
Why it's wrong here
Gateway endpoints are for S3 and DynamoDB, not for general internet traffic.
- ✓
Place the NAT device in a public subnet with a route to an internet gateway.
Why this is correct
The NAT device needs a route to the internet gateway to forward traffic.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?
medium- ✓ A.NAT Gateway
- B.VPC Peering
- C.AWS VPN
- D.Internet Gateway
Why A: A NAT Gateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound traffic from the internet. An Internet Gateway (option D) would allow inbound traffic, which is not allowed. VPC Peering (option B) and AWS VPN (option C) do not provide internet access.
Variation 2. A security engineer is designing a VPC with public and private subnets in two Availability Zones. The company requires that all outbound traffic from private subnets to the internet must go through a single, centrally managed NAT gateway. Which combination of resources and route table entries should be used?
medium- ✓ A.A single NAT gateway in a public subnet, and a default route (0.0.0.0/0) in each private subnet route table pointing to that NAT gateway.
- B.A single NAT gateway in a private subnet, and a default route in each private subnet pointing to the NAT gateway.
- C.One NAT gateway per private subnet, each with a route to an internet gateway.
- D.One NAT gateway per Availability Zone, with routes to the internet gateway.
Why A: A single NAT gateway placed in a public subnet (with an Internet Gateway route) can be used by multiple private subnets across different Availability Zones. Each private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's elastic network interface (ENI) or NAT Gateway ID, ensuring all outbound traffic from private instances is source-NATed through that single, centrally managed device.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.